SafeKey & Online Safety
It's how we check in when you check out
SafeKey brings safety and ease to online transactions.
When you check out online at participating merchants, SafeKey's advanced technology works in the background to make sure it's really you using your Card. And if we need to, we'll ask you to confirm it's you with face or fingerprint ID, an App notification, or a code.
How SafeKey might check in
Use face or fingerprint ID
Prove it's you by scanning your face or fingerprint
Tap and App notification
Tap the notification from the American Express® App to confirm it's you
Enter a code
We'll send you a code at checkout by text or email
Turn on App notifications
- Download the Amex App* or make sure you have the latest version
- Turn on notifications so you don't miss us checking it's you
- Turn on ‘remember this device’ in the app (Account > Two Step Verification)
Update contact details
We'll need the right email and phone number for you so we can send you codes at checkout. Log into your Amex Account and go to 'Edit Contact Details’.
Enable face or fingerprint ID
Next time you're checking out online, look out for the option to enable face or fingerprint ID.
Online Safety
In addition to SafeKey, here are some things to be aware of to help protect yourself when shopping online:
- The web address should start with ‘https://’ – the ‘s’ stands for secure.
- It should have a padlock symbol in the browser address bar.
- In some browsers, the address bar or the company name is in green.
- Log out of every site, every time you’ve registered your details, simply closing the browser isn’t enough.
- Choose strong, unique passwords (not your child’s birthday, for example).Using a secure password manager may be helpful.
- Keep your anti-virus software up to date and install a firewall.
- Make sure your spam filter is switched on.
SafeKey FAQs
About SafeKey
As a Card Member, you have been automatically enrolled in American Express® SafeKey, so you don't need to pay or take any additional steps to benefit from this online security feature. SafeKey was developed in response to regulatory requirements for online purchases and therefore, Cardmembers are unable to opt out from it.
If the merchant is not participating in American Express® SafeKey, you will not be asked for any SafeKey verification information.
American Express provides online protection for all our Cardmembers. As part of our ongoing commitment to protecting your account's security, we launched American Express SafeKey to allow you to shop in an even more secure online environment. Please be assured that you are not liable for fraudulent charges on your account.
American Express takes your privacy seriously and we will not use your details for marketing purposes without your consent. Your details will be stored in accordance with our privacy policy which you can access at americanexpress.com/us/company/privacy-center/online-privacy-disclosures.
American Express will never email you to ask you for sensitive information. If you receive a suspicious email which claims to be from American Express, do not click on any links. If you have any questions, please call the number on the back of your Card.
If you ever suspect that fraudulent contact information changes or purchases have been made on your account, please call us immediately at the number on the back of your Card.
A transaction could fail for various reasons. If you fail to verify your identity when asked (enter the correct verification code, respond to an app notification, use your facial recognition or fingerprint), access to SafeKey may time-out and be locked. Technical issues in the merchant's payment service could also interrupt the transaction. In each of these cases, you will receive an on-screen notification letting you know what went wrong. If you have any questions, you can always call the number on the back of your Card for help.
Face or fingerprint ID
American Express SafeKey face or fingerprint ID utilizes FIDO standards built around public key cryptography. A secure private key on the Cardmember’s device (which American Express cannot access) generates an authentication code which can be used in conjunction with the public key to authenticate the online payment transaction.
You may be asked to enable face or fingerprint ID for SafeKey authentication after completing a SafeKey checkout on a browser and device that support face or fingerprint ID. We may then use your face or fingerprint ID to verify your identity for future purchases on the same device and browser.
On some occasions, we may need you to enable face or fingerprint ID even though you had already done so previously. Here are some examples of those situations:
- You are using a new browser or device
- You have recently cleared cookies
Face or fingerprint ID for SafeKey can be disabled by accessing the "Settings" menu in the SafeKey header (upper right corner) during a purchase. Simply toggle the face or fingerprint ID option into the "off" position.
American Express does not have access to your face or fingerprint ID data. For more information, see your device and operating system privacy policies and security guides.
App Notifications
If you have downloaded the app and enabled notifications for it on multiple devices, SafeKey identity verification notifications will be sent to the latest device on which you have turned on ‘remember this device’.
If you don’t receive a notification, then you can click “resend notification” to get a new notification sent to your device. If the notification is still not received, then you can complete authentication by selecting “send verification code instead”. This will allow you to complete authentication with a one-time passcode.
The notification will remain active for 30 seconds before it will timeout and SafeKey will fallback to another authentication method.
If you receive a SafeKey identity verification notification but do not recognise the transaction, you should tap the notification, and select ‘no’ when asked if it’s you making the purchase. For any questions you can call the number on back of your card.
Verification codes
You can confirm the mobile phone number and email address you have on file for your American Express Cards either by logging into your online account at americanexpress.com/accountservices to view your personal details or by calling the number on the back of your Card. If you have an Additional Card on your account, each Card can have a different mobile phone number or email address associated with it. If a mobile phone number and/or email address has not been put on file for the Additional Cards, you should advise the Additional Card Members on your account to provide that information by logging into their account at americanexpress.com or by calling the number on the back of their Card.
The Verification Code is valid for 10 minutes after it is generated by the transaction. If you click the ‘Resend now’ button within that 10-minute window, then the same verification code will be re-sent to you. If you click the ‘Resend now’ button after the 10-minute window expires, then you will need to start the entire transaction process again which will generate a new verification code.
Please also check your email spam folder and note that SMS texts cannot be delivered to certain countries.
Related Pages
Phishing and Scam Awareness
Protect yourself from phishing and scams by learning how to recognize imposters and spot their tricks before it’s too late.
Learn more